Trojan.DownLoader41.10403

Technical Information

Modifies file system

Creates the following files

%APPDATA%\jwrapper-remote support\logs\wrapper-2021-08-13-15-53-11-348.log
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\blacklisted.certs
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\cacerts
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\java.policy
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\java.security
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\javaws.policy
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\policy\limited\local_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\policy\limited\us_export_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\policy\unlimited\local_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\policy\unlimited\us_export_policy.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\sound.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\tzdb.dat
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\tzmappings
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\charsets.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\charsets.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\access-bridge-64.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\access-bridge-64.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\cldrdata.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\cldrdata.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\jaccess.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\jaccess.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunmscapi.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunmscapi.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunpkcs11.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunpkcs11.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\jsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\jsse.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\rt.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\rt.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\license
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\security\blacklist
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\readme.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\resources.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\psfont.properties.ja
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fontconfig.bfc
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fontconfig.properties.src
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidabrightdemibold.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidabrightdemiitalic.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidabrightitalic.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidabrightregular.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidasansdemibold.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidasansregular.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidatypewriterbold.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\fonts\lucidatypewriterregular.ttf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\hijrah-config-umalqura.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\cursors.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\invalid32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\win32_copydrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\win32_copynodrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\win32_linkdrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\win32_linknodrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\win32_movedrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\images\cursors\win32_movenodrop32x32.gif
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\jce.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\jvm.hprof.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\logging.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\management\jmxremote.access
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\management\jmxremote.password.template
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\management\management.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\management\snmp.acl.template
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\management-agent.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\meta-index
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\net.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\psfontj2d.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwappspec-jwrapperjrecompatibilityapp
%WINDIR%\temp\hsperfdata_tvqjeb$\1524
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\welcome.html
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper-remote support-icns.icns
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper-remote support-uninstallerico.icopng
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper_utils.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper_license
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\session_win.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\elev_win.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\elev_mac
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwbuildversion
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwappnote-jwrapperjrecompatibilityapp
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapperlaunch
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\remote supportwinlauncher.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwutils_win32.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwutils_win64.dll
%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00063527365-complete\bin\remote supportecompatibility.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\unrestricted\jwlaunchproperties-1628895278729-0
%TEMP%\hsperfdata_user\2392
%APPDATA%\jwrapper-remote support\logs\remote support-jwrapperjrecompatibilityapp-2021-08-13-15-54-40-994-pid0.log
%APPDATA%\jwrapper-remote support\jwapps\jre-lastsuccessfuloptions-jwrapper-windows64jre-00063527365-complete
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapperusejre
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\unrestricted\jwrapperusejre
%APPDATA%\jwrapper-remote support\jwupdatearinstruction.ar-inst-incomplete
%APPDATA%\jwrapper-remote support\jwapps\remote_supportico.ico
%APPDATA%\jwrapper-remote support\jwapps\chosenlanguage
%APPDATA%\jwrapper-remote support\jwrapper-remote support-00080610402-complete\unrestricted\jwlastrun
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00080610385-complete\unrestricted\jwlastrun
%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00063527365-complete\unrestricted\jwlastrun
%APPDATA%\jwrapper-remote support\jwrapper-remote support-00080610402-complete\unrestricted\jwlaunchproperties-1628895284114-2
%TEMP%\hsperfdata_user\2800
%APPDATA%\jwrapper-remote support\logs\remote support-remote support-2021-08-13-15-54-47-347-pid0.log
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper-remote support-splash.png
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\flavormap.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwappspec-jwrapper_service_management_app
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwappspec-jwrappermatchedversionserverunavailable
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\windowslauncher.exe
%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00063527365-complete\bin\remote support.exe
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00080610385-complete\unrestricted\jwlaunchproperties-1102650594-20
%TEMP%\hsperfdata_user\2436
%ALLUSERSPROFILE%\oracle\java\.oracle_jre_usage\1a0493e68e8c0bd.timestamp
%APPDATA%\jwrapper-remote support\logs\genericupdater-2021-08-13-15-54-17-247-pid0.log
%APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_interim
%APPDATA%\jwrapper-remote support\jwapps\jrenameoverride
%APPDATA%\jwrapper-remote support\jwappssharedconfig\detectedproxies
%APPDATA%\jwrapper-remote support\jwappssharedconfig\proxycredentials
%TEMP%\imageio7345397340763012712.tmp
%TEMP%\imageio8431754090929659491.tmp
%TEMP%\imageio2310277704118967477.tmp
%TEMP%\imageio5048684308809090338.tmp
%TEMP%\imageio8686716633143118685.tmp
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00080610385-complete\unrestricted\jwrapper-remote support-splash.png
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\de.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\en.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\es.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\fr.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\it.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\nl.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\pt.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\sv.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\translations\da.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\customer.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\sevenzip.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwappspec-remote_support
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwappspec-autotest
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\release
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\thirdpartylicensereadme.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunjce_provider.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\dt_socket.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-processthreads-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-processthreads-l1-1-1.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-profile-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-rtlsupport-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-string-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-synch-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-synch-l1-2-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-sysinfo-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-timezone-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-util-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-conio-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-convert-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-environment-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-filesystem-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-heap-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-locale-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-math-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-multibyte-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-private-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-process-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-runtime-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-stdio-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-string-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-time-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-crt-utility-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\awt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\bci.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\concrt140.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\dcpr.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-processenvironment-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\decora_sse.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-namedpipe-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-localization-l1-2-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\nativesplash.png
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwbuildversion
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwrapperlib\jwstandalonelaunch.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwrapperlib\jwstandalone.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwrapper-remote support-splash.png
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwrapper-remote support-icns.icns
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwutils_win32.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwutils_win64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\libjwutils_linux32.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\libjwutils_linux64.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\libjwutils_linux32arm.so
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\libjwutils_macos32.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\libjwutils_macos64.jnilib
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\simpleservice.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwauthorpublickey
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwrapperlaunch
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895191-4-app\jwrapper-jwrapper-version.txt
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00080610385-complete\jwrapper-windows64jre-version.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-console-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-datetime-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-debug-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-errorhandling-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-file-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-file-l1-2-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-file-l2-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-handle-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-heap-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-interlocked-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-libraryloader-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\api-ms-win-core-memory-l1-1-0.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\npt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\meta-index
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\eula.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\resource.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\server\jvm.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\server\xusage.txt
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\splashscreen.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\ssv.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\ssvagent.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\sunec.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\sunmscapi.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\t2k.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\ucrtbase.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\vcruntime140.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\verify.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\w2k_lsa_auth.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\windowsaccessbridge-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\zip.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\copyright
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\accessibility.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\amd64\jvm.cfg
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\calendars.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\classlist
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\cmm\ciexyz.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\cmm\gray.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\cmm\linear_rgb.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\cmm\pycc.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\cmm\srgb.pf
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\content-types.properties
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\currency.data
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\prism_d3d.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunec.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\pack200.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\nio.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\fontmanager.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\hprof.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\instrument.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\j2pcsc.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\j2pkcs11.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jaas_nt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\java-rmi.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\java.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\java.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\javaaccessbridge-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\javafx_font.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\javafx_iio.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\javaw.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jawt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jawtaccessbridge-64.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jdwp.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jjs.exe
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jli.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jpeg.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jsdt.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jsound.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\jsoundds.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\kcms.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\lcms.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\management.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\mlib_image.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\msvcp140.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\msvcr100.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\net.dll
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\dt_shmem.dll
%WINDIR%\temp\hsperfdata_tvqjeb$\2524

Deletes the following files

%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\charsets.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\unrestricted\jwlaunchproperties-1628895278729-0
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper_utils.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\sevenzip.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\customer.p2
%TEMP%\imageio8686716633143118685.tmp
%TEMP%\imageio5048684308809090338.tmp
%TEMP%\imageio2310277704118967477.tmp
%TEMP%\imageio8431754090929659491.tmp
%APPDATA%\jwrapper-remote support\jwupdatearinstruction
%TEMP%\imageio7345397340763012712.tmp
%APPDATA%\jwrapper-remote support\jwrapper-jwrapper-00080610385-complete\unrestricted\jwlaunchproperties-1102650594-20
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\rt.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\jsse.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunpkcs11.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\sunmscapi.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\jaccess.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\cldrdata.jar.p2
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\lib\ext\access-bridge-64.jar.p2
%APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_complete
%APPDATA%\jwrapper-remote support\jwrapper-remote support-00080610402-complete\unrestricted\jwlaunchproperties-1628895284114-2

Moves the following files

from %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_interim to %APPDATA%\jwrapper-remote support\jwapps\jrenameoverride.afos_complete
from %APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\customer.jar to %APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\customer.p2
from %APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\sevenzip.jar to %APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\sevenzip.p2
from %APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper_utils.jar to %APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper_utils.p2
from %APPDATA%\jwrapper-remote support\jwupdatearinstruction.ar-inst-incomplete to %APPDATA%\jwrapper-remote support\jwupdatearinstruction

Substitutes the following files

%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\customer.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\sevenzip.jar
%APPDATA%\jwrapper-remote support\jwrappertemp-1628895261413-5\jwrapper_utils.jar

Network activity

Connects to

'su#####.silloway.net':80

TCP

HTTP GET requests

http://su#####.silloway.net/customer/JWrapper-Windows64JRE-version.txt?ti#############
http://su#####.silloway.net/customer/JWrapper-Windows64JRE-00063527365-archive.p2.l2
http://su#####.silloway.net/customer/JWrapper-Remote%20Support-version.txt
http://su#####.silloway.net/customer/JWrapper-JWrapper-version.txt
http://su#####.silloway.net/customer/JWrapper-Remote%20Support-00080610402-archive.p2.l2
http://su#####.silloway.net/customer/JWrapper-Remote%20Support_os_jwwin-version.txt
http://su#####.silloway.net/customer/JWrapper-Remote%20Support_os_jwwin-00080610402-archive.p2.l2

UDP

DNS ASK su#####.silloway.net

Miscellaneous

Creates and executes the following

'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\charsets.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\charsets.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\access-bridge-64.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\access-bridge-64.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\cldrdata.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\cldrdata.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\jaccess.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\jaccess.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\sunmscapi.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\sunmscapi.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\sunpkcs11.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\ext\sunpkcs11.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\jsse.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\jsse.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\unpack200.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\rt.jar.p2" "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895206-5-app\lib\rt.jar"
'%APPDATA%\jwrapper-remote support\jwrappertemp-1628895206-5-app\bin\windowslauncher.exe' "-Xshare:dump"
'%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00063527365-complete\bin\remote supportecompatibility.exe' -cp "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895261413-5\jwrapper_utils.jar;%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895261413-5\customer.jar;%APPDATA%\JWrapper-Remote Supp...
'%APPDATA%\jwrapper-remote support\jwrapper-windows64jre-00063527365-complete\bin\remote support.exe' -cp "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00080610402-complete\jwrapper_utils.jar;%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00080610402-complete\customer.ja...
'%APPDATA%\jwrapper-remote support\jwrapper-remote support-00080610402-complete\session_win.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-Windows64JRE-00063527365-complete\bin\windowslauncher.exe" "-cp" "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00080610402-complete\jwra...' (with hidden window)
'%ALLUSERSPROFILE%\simplehelp\elevatesh\simpleservice.exe' -uninstallbyname ShTemporaryService77969586' (with hidden window)

Executes the following

'<SYSTEM32>\icacls.exe' %ALLUSERSPROFILE%\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWAppsSharedConfig" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWAppsSharedConfig\DetectedProxies" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWAppsSharedConfig\ProxyCredentials" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-JWrapper-00080610385-complete\unrestricted\JWrapper-Remote Support-splash.png" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWrapperTemp-1628895261413-5\unrestricted" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWApps\JRE-LastSuccessfulOptions-JWrapper-Windows64JRE-00063527365-complete" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWApps\Remote_SupportICO.ico" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWApps\ChosenLanguage" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-Remote Support-00080610402-complete\unrestricted\jwLastRun" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-JWrapper-00080610385-complete\unrestricted\jwLastRun" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-Windows64JRE-00063527365-complete\unrestricted" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%APPDATA%\JWrapper-Remote Support\JWrapper-Windows64JRE-00063527365-complete\unrestricted\jwLastRun" /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp" /t /c /grant *S-1-1-0:(OI)(CI)F
'<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\SimpleHelp\ElevateSH\*.*" /t /c /grant *S-1-1-0:(OI)(CI)F

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней